Janik Wehrli

Insecure Access Control Lists (ACLs) are set on all DLL files within the installation directory `C:Program Files (x86)Remote Utilities - Host`, granting full control to the built-in Everyone group. A Windows service running as `NT AUTHORITYSYSTEM` loads DLLs from this location. While files are locked during runtime, a race window occurs when the service is stopped, such as during a crash or software update. This allows a local unprivileged attacker to replace a DLL with a malicious payload, which then executes with system privileges upon service restart. The DLL `libasset32.dll` was confirmed as actively loaded, and other affected files include `eventmsg.dll`, `libcodec32.dll`, `vp8encoder.dll`, `vp8decoder.dll`, `webmvorbisdecoder.dll`, `webmvorbisencoder.dll`, and `webmmux.dll`.

The servereye client, also known as sensorhub or ClientAgentContainerService, contains a local privilege escalation flaw. The high-privileged service SE3Recovery (EmergencyRecoveryService.exe) runs as SYSTEM and monitors the directory `%ProgramData%ServerEye3update` for a trigger file named `update available`. Because of insufficient access restrictions on this directory, a local standard user can create the trigger file and specify a path to a directory containing malicious JSON instructions. The service then executes the utility UpdaterAction.exe with SYSTEM privileges, which parses these instructions and performs an unvalidated file copy from a user-controlled source to a protected system destination, such as overwriting a service binary. This allows for full system compromise when the service automatically restarts the overwritten binary with SYSTEM privileges.

An SQL Injection issue exists in the login function in actions.php. This allows for potential unauthorized access to sensitive data.